How to review AI-generated code

Why review at all

When an app runs and the preview looks right, it is tempting to move on. A passing look is not the same as correct code. AI can produce output that works for the happy path and fails on everything else, or that quietly does something unsafe.

Reviewing is how you catch the gap between looks fine and is fine. It also helps you understand your own app, which pays off every time you need to change it.

Read the code, section by section

Start by reading, not just running. You do not need to grasp every line at once, but you should be able to follow the shape of what was built.

• Find where user input comes in and where data is saved.
• Follow one important feature from the button click to the result.
• Ask the agent to explain any part you cannot follow.
• Watch for code that looks copied in but never actually used.

If a section is confusing, that is a signal to slow down, not to skip ahead.

Test the parts that matter

Reading finds some problems, testing finds others. Try the app the way a careful or careless user would.

• Submit empty forms and forms with obviously wrong values.
• Enter very long text, odd characters, and unexpected input.
• Try actions in the wrong order and see what breaks.
• Repeat an action to check nothing gets duplicated or corrupted.

Write down what should happen for each case, then check whether it does. Surprises here are exactly what you want to find before your users do.

Check security and access

Security bugs are easy to miss because the app still looks like it works. Give these extra attention.

• Confirm that one user cannot see or change another user's data.
• Check that pages needing a login actually require one.
• Make sure secrets and keys are not exposed in the app or the code you share.
• Be cautious with anything that runs input as a command or query.

If an app handles accounts, payments, or personal data, treat this section as required rather than optional.

Work in small, reviewable steps

The easiest code to review is a small change you asked for on purpose. Big all-at-once builds are harder to check and harder to trust.

• Ask for one feature at a time and review it before the next.
• Keep changes focused so you can see what actually changed.
• Re-test the flows a change could have affected, not just the new part.

This rhythm keeps review manageable and keeps problems small.

Know when to get help

Some code deserves a second set of eyes. If a feature carries real risk and you are not sure it is right, that is a good moment to ask a developer to review it.

Using an AI agent does not remove the need for judgment. It shifts your job toward reading, testing, and deciding what is safe to ship, which is where your attention adds the most value.

Frequently asked questions

Explore more